Subject: Re: [ietf-dkim] The URL to my paper describing the DKIM policy options

From: Scott Kitterman <[email-masked]>
Date: Fri, 28 Jul 2006 8:26 -0400

On Thu, 27 Jul 2006 16:50:17 -0700 Jon Callas <[email-masked]> wrote:
>On 27 Jul 2006, at 4:01 PM, Scott Kitterman wrote:
>
>> To clarify, by me, I meant my domain.  The problem is that in this  
>> type of
>> scenario, there is no way to externally distinguish  between mail  
>> actually
>> sent by the vanity domain owner and mail sent by another customer of
>> isp.example.com
>>
>
>I would phrase it as a "situation" or "issue" rather than a "problem."
>
>However, it's not strictly true. Example.com is supposed to be  
>signing the "From" header field. (Section 5.4: "The From header field  
>MUST be signed....") If the From line from your domain is different  
>from the other customers, then it can be distinguished.
>
Yes and what is another customer of the ISP submits mail using my From.  in 
virtually all cases today there is nothing to prevent that.

>>>> This is really an internal ISP operational problem (they need to
>>>> sort out who
>>>> is allowed to use what identities on their servers), but the
>>>> protocol and
>>>> associated guidance need to make that clear.
>>>
>>> How is it not clear now?
>>>
>> I'm not sure yet.  At this point we're just talking about  
>> requirements and if
>> this type of requirement is covered through policy or not.
>
>I think it's covered in the *syntax*.
>
As long as the proper controls are in place at the ISP and the policy 
protocol allows me to express which domain(s) are authorized to sign for my 
domain.

Scott K
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: John Levine <[email-masked]>
Date: 28 Jul 2006 18:23:13 -0000

>virtually all cases today there is nothing to prevent that.

If you give your keys to untrustworthy third parties, all bets are
off.  No amount of extra protocol goop is going to change that.

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Fri, 28 Jul 2006 11:43:15 -0700

On Jul 28, 2006, at 11:23 AM, John Levine wrote:

>> Yes and what is another customer of the ISP submits mail using my  
>> From.  in virtually all cases today there is nothing to prevent that.
>

Scott has raised a different concern.  An ISP may not restrict what  
 From is used when signing with the ISP's domain.  An ISP might also  
request a confirmation that the sender can receive message at that  
address before allowing use of the address.  The policy expressed at  
the OA (rfc2822.From) indicates the specific set of signing domains  
that have been designated as signing on behalf of the OA.  This would  
be independent of who has what keys.  This would be strictly a  
function of the OA policy.

-Doug

---

From: John L <[email-masked]>
Date: Fri, 28 Jul 2006 14:55:05 -0400 (EDT)

>> If you give your keys to untrustworthy third parties, all bets are off.  No 
>> amount of extra protocol goop is going to change that.
>
> Scott has raised a different concern.  An ISP may not restrict what From is 
> used when signing with the ISP's domain.

In what sense is an ISP who signs mail from random senders who happen to 
forge your domain not an untrustworthy third party?

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://johnlevine.com, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Scott Kitterman <[email-masked]>
Date: Fri, 28 Jul 2006 15:12:28 -0400

On Friday 28 July 2006 14:23, John Levine wrote:
> >Yes and what is another customer of the ISP submits mail using my From. 
> > in virtually all cases today there is nothing to prevent that.
>
Yes.  Absolutely.  I meant this to be a comment about pre-requisites, not 
something that could be solved in protocol.

Scott K

---

From: Douglas Otis <[email-masked]>
Date: Fri, 28 Jul 2006 14:21:49 -0700

On Jul 28, 2006, at 11:55 AM, John L wrote:

>>> If you give your keys to untrustworthy third parties, all bets  
>>> are off.  No amount of extra protocol goop is going to change that.
>>
>> Scott has raised a different concern.  An ISP may not restrict  
>> what From is used when signing with the ISP's domain.
>
> In what sense is an ISP who signs mail from random senders who  
> happen to forge your domain not an untrustworthy third party?

For most users, the main motivation will likely be to improve message  
delivery.  Being able to associate the From with the signing domain  
should definitely improve delivery, especially in an era known for  
its delivery obstacles.  It seems reasonable to assume a designation  
worthy ISP does not offer access to just anyone, where risk of  
forgery by these users might be reasonably low.  If there was an  
incident of forgery, an existing relationship with the ISP should  
provide corrective actions from a report of abuse.  If forgery  
becomes an ongoing problem, procedures typically used for subscribing  
to a mailing list could also provide a reasonable means for the ISP  
to prevent forgery in a fairly automated fashion.  The ISP would log  
outbound email-address use per account, and hold messages until a  
newly logged email-address is confirmed by this email-address's  
recipient.

The terminology that was being used was Designated Signing Domain and  
not a trusted third-party.  Who is the third-party, the OA or the  
signing domain?  When dealing with abuse, it is easy to view the OA  
as a third-party.  These terms may provide more clarity:

Designated Signing Domain (DSD) = Any domain designated to sign for  
an OA.

Common Signing Domain (CSD) = The signing domain and the OA share the  
same domain.

Parent Signing Domain (PSD) = The signing domain is a parent of the  
OA domain.

Non-Designated Domain (NDD) = Any other domain, signed or not.

A DSD could also be a CSD.  A PSD could also be a NDD.

-Doug

---

From: Jon Callas <[email-masked]>
Date: Fri, 28 Jul 2006 14:51:53 -0700

> happen to forge your domain not an untrustworthy third party?

I would refer to them as an untrustworthy second party, myself.

It's kinda like saying what happens if the manager of the hotel  
you're staying at gives the key to your room to someone else. Yes,  
this is a problem. However, it's beyond the scope of the lockmaker.

	Jon

---

From: Jon Callas <[email-masked]>
Date: Fri, 28 Jul 2006 15:00:45 -0700

On 28 Jul 2006, at 12:12 PM, Scott Kitterman wrote:

>>> From.

Thanks for the clarification.

	Jon